New opportunity

Senior GRC Lead – Cyber Risk, Compliance & Security Automation

Remoto Remoto Senior

About the company

We are a young and fast-growing recruiting company with five years of experience working across Latin America and the United States. We partner closely with teams and founders to help them build strong, high-impact teams through recruitment, outsourcing, and team-building services.

Our culture is built on effective communication, trust, and transparency. We believe great work happens when people feel heard, supported, and empowered to grow. Today, our team is made up of more than 80 professionals working across different projects throughout the region, collaborating remotely and learning from each other every day.

About the role

We are looking for a Senior GRC Lead to own and evolve cybersecurity governance, risk management, and compliance programs within a highly regulated, critical-infrastructure environment spanning digital assets, energy, and high-performance computing.

This is a strategic and hands-on leadership role that combines ISO 27001 and SOC 2 compliance, cyber risk management, third-party risk, M&A security due diligence, and compliance engineering.

You will be responsible for building and strengthening the organization's GRC framework, leading certification and audit readiness initiatives, establishing risk management methodologies, and implementing automated processes for control evidence collection and testing.

A key priority will be preparing the organization for ISO 27001 Stage 1 and SOC 2 Type I, followed by ISO 27001 Stage 2 and SOC 2 Type II, ensuring controls are properly designed, documented, implemented, and tested for operating effectiveness.

Beyond compliance execution, you will define the GRC roadmap, act as the primary point of contact for external auditors, collaborate with executive stakeholders, and help build and mentor the security engineering function.

We are looking for someone who combines strong technical knowledge with business-oriented thinking, enjoys creating processes and frameworks from the ground up, and can translate complex security and compliance requirements into practical, scalable solutions.

Responsibilities

Compliance & Certification
Own and operate the ISO 27001:2022 Information Security Management System (ISMS), including scope definition, risk methodology, Statement of Applicability, internal audits, management reviews, corrective actions, and surveillance activities.
Lead SOC 2 Type I and Type II initiatives, including scoping, control mapping, evidence collection, auditor walkthroughs, and ongoing readiness.
Drive preparation for ISO 27001 Stage 1 and Stage 2 certification audits.
Establish and maintain a unified control framework mapped across multiple security and compliance standards.
Identify compliance gaps, coordinate remediation activities, and ensure audit readiness.
Cyber Risk Management
Own the cybersecurity risk management program, including risk registers, assessments, treatment plans, risk acceptance, and reporting.
Define and apply recognized risk methodologies such as NIST IR 8286, ISO 27005, or FAIR.
Partner with technical and business stakeholders to prioritize remediation activities.
Present risk posture, key findings, and remediation recommendations to leadership.
Third-Party & Supply Chain Risk
Manage the complete third-party risk lifecycle, including vendor intake, risk tiering, assessments, exceptions, continuous monitoring, and offboarding.
Review vendor security documentation, including SOC 2 reports, ISO certifications, security questionnaires, and penetration testing summaries.
Identify vendor-related security risks and drive remediation through closure.
Extend third-party risk coverage to Software Bills of Materials (SBOMs), SaaS providers, and AI-related vendors.
M&A Security & Regulatory Compliance
Lead cybersecurity due diligence for mergers and acquisitions, assessing security posture, data exposure, compliance gaps, remediation requirements, and integration costs.
Develop repeatable security due diligence processes and playbooks.
Support Day 1 and 100-day post-acquisition security integration planning.
Maintain documentation, control plans, and evidence for regulatory standards such as NERC CIP, collaborating with engineering teams responsible for technical controls.
Compliance Engineering & Automation
Design and implement automated evidence collection and control testing processes using GRC platforms, workflow automation tools, and cloud, identity, and SaaS APIs.
Develop scripts and integrations, using technologies such as Python, to streamline compliance activities.
Establish repeatable automation workflows, runbooks, monitoring, and failure-handling processes.
Collaborate with IT and Engineering teams to resolve blocked controls, track remediation, and document exceptions.
Identify opportunities to improve compliance efficiency through automation and technical integrations.
GRC Leadership & Stakeholder Management
Define the methodology, strategy, and roadmap for the GRC function.
Establish policies, procedures, control frameworks, metrics, and reporting processes.
Manage the complete policy lifecycle, from drafting and review through approval, publication, and employee attestation.
Act as the primary liaison with external auditors and coordinate audit engagements.
Lead executive and client-facing discussions, including engagement kickoffs, scoping, and security assessments.
Contribute to presales activities and the preparation of Statements of Work (SOWs).
Participate in interviewing, onboarding, and mentoring GRC and Security Engineering professionals.
Communicate compliance status, risk exposure, audit readiness, and strategic recommendations to technical and executive stakeholders.

Requirements

Ideally 8+ years of experience in Governance, Risk & Compliance (GRC), cybersecurity, or information security, including several years in a leadership, management, consulting, or vCISO capacity.
Demonstrated experience building a compliance or GRC program from scratch or near-scratch, including policies, risk registers, control frameworks, methodologies, and performance metrics.
Strong hands-on experience with ISO 27001 and SOC 2, including audit preparation, control implementation, evidence management, and external auditor coordination.
Experience serving as the primary point of contact for external auditors during SOC 2, ISO 27001, SOX ITGC, PCI DSS, or HIPAA engagements.
Strong understanding of cybersecurity risk assessment methodologies and risk treatment processes.
Experience managing third-party and vendor security risk assessments.
Ability to define security governance frameworks and translate regulatory requirements into operational controls.
Technical understanding of cloud environments, identity systems, SaaS platforms, APIs, and security controls.
Experience identifying opportunities to automate compliance processes and evidence collection.
Strong client-facing and executive communication skills, including the ability to lead kickoffs, scope engagements, and contribute to presales and SOW development.
Experience defining strategic roadmaps, establishing methodologies, and leading cross-functional initiatives.
Ability to interview, onboard, mentor, and provide technical guidance to security or GRC engineers.
Strong ownership mentality, analytical thinking, and ability to work independently in complex environments.

Nice to have

Experience with M&A cybersecurity due diligence or post-merger security integration.
Background in digital assets, energy, data centers, high-performance computing, or critical infrastructure.
Familiarity with NERC CIP, IEC 62443, or other operational technology security standards.
Experience with workflow automation platforms, API-driven integrations, and automated evidence pipelines.
Knowledge of AI governance frameworks, including ISO 42001 and NIST AI Risk Management Framework.

Benefits

People First culture
Referral Program
Free access to streaming platforms
Free access to Spotify Premium
GYM discount
Travel discount
E-Learning discount
Birthday-day gift
Points Program